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♦ 2001-Present 

• Technical Integration Manager - Real-time Control Software 

• Orbital Space Plane - Avionics and Flight Software Lead 

• Strategic Technology Development Manager - Command and 
Control 

• Technical Lead for the Supportability of Non-Terrestrial Systems 

• Constellation Program - Ground Operations Command and Control 
Architect 

♦ Currently 

• 21 st Century Space Launch Complex - Range Interface & Control 
Services product group lead 
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Space Shuttle Main Engine Avionics 


♦ The Space Shuttle Main Engines 

• The three Space Shuttle Main Engines are 
clustered at the aft end of the Orbiter and 
have a combined thrust of more than 1.2 
million pounds. They are high performance, 
liquid propellant rocket engines whose thrust 
can be varied over a range of 65 to 109 
percent of their rated power level. They are 
the world's first reusable rocket engines and 
are 14 feet long and 7.5 feet in diameter at 
the nozzle exit. The Main Engine weighs 
approximately 7,000. Propelled by liquid 
hydrogen (fuel) and liquid oxygen (oxidizer), 
the engines operate during the entire eight- 
and-one-half-minute ride to orbit. 
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What Happened 
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♦ Engine Maintenance between flights detected corrosion in main combustion 
chamber requiring additional liquid oxygen injector posts to be plugged. 

• Inspections a manual and occur after every flight 

♦ Software constants were not updated (process failure) 

♦ Resulting combustion flow caused higher temperatures in the turbine outlet 

♦ Temperatures were as predicted 

♦ Temperatures were above the software redline 

♦ Engine initiated showdown. 

♦ Space Shuttle orbiter shutdown the other two engines 


♦ Take away - there are many areas in both the flight and ground systems 
where periodic maintenance is required. NASA has been working towards 
predictive maintenance for some time, but as a technology program largely 
not in operations 
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STS-110 Tanking 



Waiting on STS-110 MLP 
GH2 Leak Video from PAO 
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STS-110 Tanking / What Happened 
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♦ STS - 110 / April 4, 2002 

♦ Large vapor cloud coming from Mobile Launch Platform (MLP) vent line on 
side 4. Probable cracked weld leaking gh2 

♦ Welds used wrong filler material 

• Operational work around - 'clam shells' welded over all discrepant welds. 
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♦ Lessons Learned from Space Shuttle and International Space Station were 
applied to the Constellation Program 

♦ Attempt to improve Operability in the design 
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COMPONENTS OF THE CONSTELLATION PROGRAM 


Earth Departure Stage 


Kt 




Ares 1/ : 

Heavy Lift 
Launch Vehicle 


Ares I : 

Crew Launch Vehicle 


A - W. 
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Orion: 

Crew Exploration 
Vehicle 


Lunar Lander 
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BUILDING ON A FOUNDATION OF PROVEN TECHNOLOGIES 

Launch Vehicle Comparisons 
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Upper Stage 
(1 J-2X) 

127Mt LOx/LHi 



Lunar 

Lander 



Earth Departure 
Stage (EDS) (1 J-2X) 
226Mt lb LOx/LH 2 


Core Stage 
(5 RS-68 Engines) 
141 OMt LOx/LH 2 


5-Segment 
2 RSRB's 



Crew 

Lander 


S-IVB 

(1 J-2 engine) 

11 OMt Lox/LH 2 

S-ll 

(5 J-2 engines) 
450Mt LOx/LH 2 


S-IC 
(5 F-1) 

1770Mt LOx/RP 
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Meiqnt 98m 
I frort QlOMt 

22Mt to LEO 


Ares V 

Height I09rr 
Grr^fc Litton Mast 3 3*. OMt 
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65Mt to TLI in Dual- 
Launch Mode with Ares I 
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Saturn V 
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Grcss Liftoff Mass 29SuK't 
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TYPICAL LUNAR REFERENCE MISSION 


- Ares V liftoff; solid rocket booster separation 

- Earth Departure Stage performs Earth orbit insertion 

- Payload shroud separates to expose Lunar lander 

- Ares I liftoff, first stage and upper stage separate 

- Upper stage performs Earth orbit insertion; Orion separates 

- Orion docks with Lunar module and Earth Departure Stage 

- Earth Departure Stage fires for lunar destination 

- Orion and Lunar lander separate from Earth Departure Stage 

- Lunar orbit insertion 




\ ' ^ V 


- Lunar lander separates from Orion 
and lands on moon 

- 4 astronauts conduct lunar activities 

- Lunar lander ascent stage lifts off from surface 

- Ascent stage and Orion dock for crew transfer 

- Orion performs trans-Earth injection burn 

- Orion and service module separate 
and re-enter Earth's atmosphere 

- Orion decelerates through Earth’s atmosphere 

- Parachutes open; capsule descends 
for landing and recovery 
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CONSTELLATION CAN LA ND ANYWHERE ON THE MOON 

Previous Missions Landed in Equatorial Band 
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Ares l-X Ground Diagnostic Prototype 


Snapshot of TEAMS model of Ares l-X TVC 

Rock 




I 1 © Simplified GDP Architecture 
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v' GDP Provided Fault Detection and Isolation for First Stage TVC System and 
Ground Hydraulic Support System 

s GDP Provided Anomaly Detection 

V GDP Was installed in Hangar AE for Ares l-X 

s The prototype ran on live data from Ares l-X during all powered on testing in the 
VAB and at PAD-39B through End of Mission 
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Fault Modeling Using TEAMS: 

Modeling Process 
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Step 1: Build subsystem functional fault model 

Transformation of energy, material, signal within the system 
Basic system connectivity, interfaces, interactions 
> Insufficient to do any analysis or to be a diagnostic engine 


Knowledge captured from subsystem schematics/diagrams/etc. 

and converted into TEAMS model 
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Fault Modeling using TEAMS 

Modeling Process 


Step 2: Populate failure modes of components 
Extracted from FMEA 

Added as “lowest level” nodes inside each component 
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Fads open 

Loss of hydraulic flow control to the SRB 

Nc effect 

3 


Becbicai 

NydraiJc fkad to SRB 


could delay opei aborts. 




Operabng Valve 


Fads dose 

Inability to flow hydraulic fluid to SRB 
would delay operations. 

No effect 

3 


Pneumatic_Electrical_Operating_Valve_A77928_1_HSS_GSf 


-ftn 


Hyd 

GN2_750_PSIG 
28V_Power 
Command O 


Supply Line Iso Valve 


;N2_7S0_PSIG 
Status_0 
Status C 


U i 






July 12, 2010 


Bob Waterman / Robert.D.Waterman@hasa.gov / NASA Kennedy Space Center; 


Fails_Open_A77928_1 


V//////// 

Y/Zvyy//.. 




Fails_Close_A77928_1 







Page "7 



Fault Modeling using TEAMS : 
Modeling Process 


Step 3: Determine failure effect propagation paths 

Each failure mode produces a specific effect / set of effects 

Propagate along physical paths (fluid, thermal, electrical) 
Implemented using TEAMS functions 
Formalization of FMEA 


now.ftmrKi«.*a9)19J.HSS_GSE P IKW*.( 






A failure of the Pneumatic Electrical Operating Valve 
to Close when commanded results in the propagation 
of the function “high supply pressure” over the 
hydraulic signal paths. 
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Fault Modeling using TEAMS : 

Modeling Process 


Step 4: Identify sensors and test points 

Function model represent the location of all sensors 

The sensors are represented using nodes 

Each sensor is associated with TEAMS “test points” 
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The test points that represent pressure gauges and transducers detect the 

;ated 


function “high supply pressure,” as indicated by the cyan and yellow coloring of 
the circular nodes. 
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Developing FDIR Modules - Fault Detection and Fault Isolation with TEAMS 

Fault Isolation Example 

D-matrix 


Tests (observables) 

Failure T1 T2 T3 T4 

Modes FM1 1 


FM2 1 


1 = test can detect failure mode 


Dependency matrix (D-matrix) is generated 
from the TEAMS Desianer subsystem model 
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Developing FDIR Modules - Fault Detection and Fault Isolation with TEAMS 

Fault Isolation Example (cont.) 


FI 
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D-matrix Tests (observables) 


Failure T 

Modes fmi 1 
(causes) FM2 1 


T1 T2 T3 


1 = test can detect failure mode 


PASS 


PASS 


GOOD 


GOOD 


GOOD 


SUSPECT 


SUSPECT 


GOOD 


SUSPECT 


im\sa 


Compute GOOD failure modes: Every failure mode connected to a PASS test is GOOD. 

Compute BAD failure modes: Every test that is FAIL has at least one failure mode that is BAD. 

If there is more than one failure mode that leads to a FAIL test, then all failure modes not labeled 
as GOOD are labeled as SUSPECT. 

All remaining failure modes are labeled UNKNOWN: they are connected to tests for which we 

uWSiGio test information Bob Waterman / Robert. D.Waterman(g>nasa 21 
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LH2 FDIR Fault Isolation using TEAMS 

Diagnosis of Clogged Liquid Hydrogen Filter 
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X and red highlighted measurement indicates 
ponent and corresponding measurement Is bad. 
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Anomaly Detection Using Inductive 
Monitoring System (IMS) 



IMS 


Inductive* MonltorinQ £>ijsfe»m 


Sensor 


Automatically learns how the system behaves 
and tells you if current behavior is out-of-family 
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)Anomaly Detection using IMS 

CQNM III A T ^ 

^Automatically derives models (off-line) from archived or simulated nominal 
operations data 

■ Does not require off-nominal data 

■ Does not require knowledge engineers or modelers to capture details of 
system operations 


Anomaly detection module can catch anomalies whose signatures are not 
known ahead of time 

Can detect subtle anomalies or anomalies that are not listed in the FMEA 

On-line monitoring takes as input observations about the physical system 
(parameter values) & produces “distance from nominal” anomaly score 


-^Analyzes multiple parameter interactions 

■ Automatically extracts system parameter relationships and interactions 

■ Detects variations not readily i 

. New data Irom sensors 

■ apparent with current individual 1 

■ parameter monitoring practices Historica , I L_ 
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The user can customize the distance that 
determines whether a point is “close 
enough” to an existing cluster to expand the 
cluster vs. creating a new one. 


Anomaly Detection using IMS: 

Modeling Example 


Step 1: Determine sensors of interest for 
subsystem & form into vectors. 


Step 2: Train on archived data representative of 
expected nominal operations... 

Training data set: 

(si, s2) 

(1.5) 

I (2, 6) 

( 1 . 2 ) 

(2,3) 

(3.6) 

(5, 1) 


... Create clusters of 
nominal operations 
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Anomaly Detection using IMS 

Monitoring Example 


Step 3: 

Using nominal operations clusters 
created in modeling step... 


... As real time data is received, compare to nominal 
operations clusters... 

Real-time data stream: 

(2, 3) 

(4,6) 

(1C 1) 

(11,8) 

(5, 2) 


... Plot distance from closest nominal 

cluster to incoming data 

and/or issue caution/warning alert. 
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There was enough (hidden) information in the STS- 107 ascent telemetry data to indicate an anomaly . 
The IMS method can help identify subtle but meaningful changes. 
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Expected Benefits 
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Many expected benefits 

■ Improves launch availability (reduces component of Mean Time To Repair) 

- Reduces integrated troubleshooting time (Isolation & Recovery Recommendation) 

■ Reduces console operator cognitive workload 

- Helps considering the reduction in console operators and non-integrated architecture of 
Ares / Orion subsystems 

- Supports reduction of FR personnel by 50% compared to Shuttle 

■ Reduces engineering support needs for Anomaly Detection and Recovery Recommendation 

■ Speeds assessment of flying with failed condition through trace to suspect failure modes. 

■ Improves time to develop flight rationale for anomalous conditions 

■ Fault modeling can uncover gaps in the analysis and forces analysis of Ground / Vehicle 
integration early 

■ Anomaly Detection can lead to early intervention, prevent further system damage, and 
reduce remediation cost and effort 

■ Captures subsystem design knowledge 

■ Provides a pathway for prognostic capabilities and Condition Based Maintenance V.S. 
Reactive Maintenance 
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Benefits will be assessed through benchmarking, performance testing, etc. 

Initial requirement is fault isolated <= 1 second after fault detected 
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Summary 
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♦ NASA will continue to pursue a robust Fault Management approach 

♦ Fault Detection , Isolation and Anomaly Detection capabilities developed for 
Constellation program will be applicable to 21 st Century Space Launch Complex as 
well as other programs 

♦ Automated and Autonomous Response as well as Prognostics continue to be 
matured as technologies 


♦ Acknowledgments - The material in this presentation was derived from work 

developed and publicly presented by the following: NASA ARC: Barbara Brown, David 
Iverson, Lilly Spirkovska, David Hall. NASA MSFC: Stephen Johnson. NASA KSC: Jose 
Perotti, Bob Ferrell. KSC ARSC: Becky Oostdyk 
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